104 lines
2.8 KiB
YAML
104 lines
2.8 KiB
YAML
---
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
|
|
|
|
firewall_trusted_subnets:
|
|
- subnet: 100.64.0.0/10
|
|
comment: Tailscale
|
|
- subnet: 204.110.188.0/22
|
|
comment: VNTX
|
|
- subnet: 10.0.0.0/8
|
|
comment: Internal
|
|
- subnet: 192.168.0.0/16
|
|
comment: Internal
|
|
- subnet: 172.0.0.0/15
|
|
comment: VNTX
|
|
- subnet: 216.180.128.0/20
|
|
comment: VNTX
|
|
- subnet: 3.228.90.246
|
|
comment: Gaiia AWS
|
|
|
|
firewall_allow_rules:
|
|
- port: 1812
|
|
proto: udp
|
|
comment: RADIUS Auth
|
|
- port: 1812
|
|
proto: tcp
|
|
comment: RADIUS Auth
|
|
- port: 1813
|
|
proto: udp
|
|
comment: RADIUS Accounting
|
|
- port: 1813
|
|
proto: tcp
|
|
comment: RADIUS Accounting
|
|
- port: 3306
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/8
|
|
comment: MySQL (internal)
|
|
- port: 3306
|
|
proto: tcp
|
|
from_ip: 204.110.188.0/22
|
|
comment: MySQL (VNTX/Gaiia)
|
|
- port: 3306
|
|
proto: tcp
|
|
from_ip: 3.228.90.246
|
|
comment: MySQL (Gaiia AWS)
|
|
- port: 3799
|
|
proto: udp
|
|
from_ip: 3.228.90.246
|
|
comment: RADIUS CoA/Disconnect (Gaiia AWS)
|
|
|
|
# FreeRADIUS role — user will manually import seed data after deploy
|
|
freeradius_load_user_data: false
|
|
|
|
# RADIUS clients (CoA/management systems)
|
|
freeradius_clients:
|
|
- name: localhost
|
|
ipaddr: "127.0.0.1"
|
|
secret: "{{ vault_freeradius_localhost_secret | default('testing123') }}"
|
|
shortname: localhost
|
|
nas_type: other
|
|
- name: gaiia
|
|
ipaddr: "3.228.90.246"
|
|
secret: "{{ vault_freeradius_gaiia_secret }}"
|
|
shortname: gaiia
|
|
nas_type: other
|
|
|
|
# NAS clients (secrets from vault.yml in this directory)
|
|
freeradius_nas_clients:
|
|
- nasname: "204.110.188.31"
|
|
shortname: "380"
|
|
secret: "{{ vault_nas_380_secret }}"
|
|
- nasname: "204.110.188.254"
|
|
shortname: "Verona"
|
|
secret: "{{ vault_nas_verona_secret }}"
|
|
- nasname: "204.110.188.62"
|
|
shortname: "Climax"
|
|
secret: "{{ vault_nas_climax_secret }}"
|
|
- nasname: "204.110.188.158"
|
|
shortname: "Culleoka"
|
|
secret: "{{ vault_nas_culleoka_secret }}"
|
|
- nasname: "204.110.188.190"
|
|
shortname: "NewHope"
|
|
secret: "{{ vault_nas_newhope_secret }}"
|
|
- nasname: "204.110.188.222"
|
|
shortname: "LowryCrossing"
|
|
secret: "{{ vault_nas_lowrycrossing_secret }}"
|
|
- nasname: "204.110.188.126"
|
|
shortname: "982"
|
|
secret: "{{ vault_nas_982_secret }}"
|
|
- nasname: "204.110.191.190"
|
|
shortname: "yorkshire"
|
|
secret: "{{ vault_nas_yorkshire_secret }}"
|
|
- nasname: "204.110.188.94"
|
|
shortname: "494"
|
|
secret: "{{ vault_nas_494_secret }}"
|
|
- nasname: "204.110.191.185"
|
|
shortname: "Core"
|
|
secret: "{{ vault_nas_core_secret }}"
|
|
- nasname: "204.110.191.252"
|
|
shortname: "Concatenator"
|
|
secret: "{{ vault_nas_concatenator_secret }}"
|
|
- nasname: "10.254.254.103"
|
|
shortname: "Yorkshire-mgmt"
|
|
secret: "{{ vault_nas_yorkshire_secret }}"
|